releng: Update debian-base and debian-iptables to buster-v1.6.0 to patch base image CVEs

[jindijamie]

What type of PR is this?

/kind feature

What this PR does / why we need it:

debian-base to buster-v1.6.0
debian-iptables to buster-v1.6.0

Which issue(s) this PR fixes:

Fixes a bunch of CVEs
Debian-iptables buster-v1.5.0
Medium CVE-2021-23840
Medium CVE-2021-23841
Low CVE-2019-1551
Low CVE-2021-3449
Low CVE-2021-24032
Low CVE-2021-24031

Debian-base buster-v1.4.0
Low CVE-2021-24031
Low CVE-2021-24032

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Base image updates to mitigate kube-proxy and etcd container image CVEs
- debian-base to buster-v1.6.0
- debian-iptables to buster-v1.6.0

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

Welcome @jindijamie!

It looks like this is your first PR to kubernetes/kubernetes 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kubernetes has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @jindijamie. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[wespanther]

I think we've actually just built a new one last week, debian-base is up to buster-v1.6.0 now.

[cjcullen]

/ok-to-test

Thanks for putting this together Di

[fedebongio]

/remove-sig api-machinery

[jindijamie]

/test

[k8s-ci-robot]

@jindijamie: The /test command needs one or more targets.
The following commands are available to trigger jobs:

• /test pull-kubernetes-conformance-image-test
• /test pull-kubernetes-conformance-kind-ipv6-parallel
• /test pull-kubernetes-dependencies
• /test pull-kubernetes-dependencies-go-canary
• /test pull-kubernetes-e2e-ipvs-azure-dualstack
• /test pull-kubernetes-e2e-iptables-azure-dualstack
• /test pull-kubernetes-files-remake
• /test pull-kubernetes-e2e-gce
• /test pull-kubernetes-e2e-gce-no-stage
• /test pull-kubernetes-e2e-gce-kubetest2
• /test pull-kubernetes-e2e-gce-canary
• /test pull-kubernetes-e2e-gce-ubuntu
• /test pull-kubernetes-e2e-gce-ubuntu-containerd
• /test pull-kubernetes-e2e-gce-ubuntu-containerd-canary
• /test pull-kubernetes-e2e-gce-alpha-features
• /test pull-kubernetes-e2e-gce-device-plugin-gpu
• /test pull-kubernetes-integration
• /test pull-kubernetes-integration-go-canary
• /test pull-kubernetes-cross
• /test pull-kubernetes-e2e-kind
• /test pull-kubernetes-e2e-kind-canary
• /test pull-kubernetes-e2e-kind-ipv6
• /test pull-kubernetes-e2e-kind-ipv6-canary
• /test pull-kubernetes-conformance-kind-ga-only
• /test pull-kubernetes-conformance-kind-ga-only-parallel
• /test pull-kubernetes-e2e-kops-aws
• /test pull-kubernetes-bazel-build-canary
• /test pull-kubernetes-bazel-test-canary
• /test pull-kubernetes-bazel-test-integration-canary
• /test pull-kubernetes-local-e2e
• /test pull-kubernetes-unit
• /test pull-kubernetes-unit-experimental
• /test pull-publishing-bot-validate
• /test pull-kubernetes-e2e-aks-engine-windows-dockershim
• /test pull-kubernetes-e2e-aks-engine-windows-containerd
• /test pull-kubernetes-e2e-aks-engine-azure-disk-windows-dockershim
• /test pull-kubernetes-e2e-aks-engine-azure-file-windows-dockershim
• /test pull-kubernetes-e2e-aks-engine-gpu-windows-dockershim
• /test pull-kubernetes-e2e-aks-engine-azure-disk-windows-containerd
• /test pull-kubernetes-e2e-aks-engine-azure-file-windows-containerd
• /test pull-kubernetes-e2e-aks-engine-conformance
• /test pull-kubernetes-e2e-aks-engine-azure-disk-vmas
• /test pull-kubernetes-e2e-aks-engine-azure-disk-vmss
• /test pull-kubernetes-e2e-aks-engine-azure-file
• /test pull-kubernetes-e2e-gce-network-proxy-http-connect
• /test pull-kubernetes-e2e-gce-network-proxy-grpc
• /test pull-kubernetes-e2e-gci-gce-autoscaling
• /test pull-kubernetes-e2e-kind-dual-canary
• /test pull-kubernetes-e2e-kind-ipvs-dual-canary
• /test pull-kubernetes-e2e-ubuntu-gce-network-policies
• /test pull-kubernetes-e2e-gci-gce-ipvs
• /test pull-kubernetes-node-e2e
• /test pull-kubernetes-node-e2e-podutil
• /test pull-kubernetes-e2e-containerd-gce
• /test pull-kubernetes-node-e2e-containerd
• /test pull-kubernetes-node-e2e-alpha
• /test pull-kubernetes-node-kubelet-serial-cpu-manager
• /test pull-kubernetes-node-kubelet-serial-topology-manager
• /test pull-kubernetes-node-kubelet-serial-hugepages
• /test pull-kubernetes-node-crio-cgrpv2-e2e
• /test pull-kubernetes-node-crio-e2e
• /test pull-kubernetes-node-kubelet-serial-memory-manager
• /test pull-kubernetes-e2e-gce-100-performance
• /test pull-kubernetes-e2e-gce-big-performance
• /test pull-kubernetes-e2e-gce-correctness
• /test pull-kubernetes-e2e-gce-large-performance
• /test pull-kubernetes-kubemark-e2e-gce-big
• /test pull-kubernetes-kubemark-e2e-gce-scale
• /test pull-kubernetes-e2e-gce-storage-slow
• /test pull-kubernetes-e2e-gce-storage-snapshot
• /test pull-kubernetes-e2e-gce-csi-serial
• /test pull-kubernetes-e2e-gce-iscsi
• /test pull-kubernetes-e2e-gce-iscsi-serial
• /test pull-kubernetes-e2e-gce-storage-disruptive
• /test pull-kubernetes-typecheck
• /test pull-kubernetes-verify-govet-levee
• /test pull-kubernetes-verify
• /test pull-kubernetes-verify-go-canary
• /test pull-kubernetes-e2e-windows-gce

Use /test all to run the following jobs:

• pull-kubernetes-conformance-kind-ipv6-parallel
• pull-kubernetes-dependencies
• pull-kubernetes-e2e-gce-ubuntu-containerd
• pull-kubernetes-integration
• pull-kubernetes-e2e-kind
• pull-kubernetes-e2e-kind-ipv6
• pull-kubernetes-conformance-kind-ga-only-parallel
• pull-kubernetes-unit
• pull-kubernetes-node-e2e
• pull-kubernetes-node-crio-e2e
• pull-kubernetes-e2e-gce-100-performance
• pull-kubernetes-typecheck
• pull-kubernetes-verify-govet-levee
• pull-kubernetes-verify

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jindijamie]

/retest

[justaugustus]

Thanks for this update, @jindijamie!
/triage accepted
/sig release
/lgtm
/approve

[justaugustus]

For cluster/images/etcd:
/assign @jpbetz @wenjiaswe

For test/utils/image:
/assign @dims

[dims]

@jindijamie can you please document which CVE(s) you had in mind in the PR body? thanks!

/approve
/lgtm

[jpbetz]

/approve

for etcd image

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, jindijamie, jpbetz, justaugustus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• build/OWNERS [justaugustus]
• cluster/images/etcd/OWNERS [dims,jpbetz]
• test/utils/image/OWNERS [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dims]

/hold

please remove hold when this is ready @justaugustus

[jindijamie]

@jindijamie can you please document which CVE(s) you had in mind in the PR body? thanks!
Done, thanks

[justaugustus]

/hold cancel
🚀